Medium severity · published Aug 11, 2025
CVE-2025-8866
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
YugabyteDB Anywhere · YugabyteDB Inc
2024.*; 2.20.* · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8866
docs.yugabyte.com
https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
More from YugabyteDB Anywhere
6.8
CVE-2025-8864
Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
2.4
CVE-2026-1966
YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI